HA
Vendor
harttle
18
CVEs
0
On KEV
1
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-106120 | LI liquidjs harttle | 6.0 | Oct 6 | LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, negative index, and for-loop iteration |
| CVE-2026-69222 | LI liquidjs harttle | 7.5 | Aug 19 | LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process |
| CVE-2026-61556 | LI liquidjs harttle | 8.7 | Aug 19 | LiquidJS: An infinite loop vulnerability in `strip_html` filter |
| CVE-2026-45618 | LI liquidjs harttle | 10.0 | Aug 11 | LiquidJS is Vulnerable to Remote Code Execution |
| CVE-2026-55575 | LI liquidjs harttle | 8.2 | Jul 8 | LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce |
| CVE-2026-45357 | LI liquidjs harttle | 7.5 | Jun 17 | LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime) |
| CVE-2026-44646 | LI liquidjs harttle | 5.3 | Jun 17 | LiquidJS: `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` |
| CVE-2026-45617 | LI liquidjs harttle | 7.5 | Jun 17 | LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex |
| CVE-2026-44645 | LI liquidjs harttle | 6.5 | Jun 17 | LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body |
| CVE-2026-44644 | LI liquidjs harttle | 6.1 | Jun 17 | LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS |
| CVE-2026-41311 | LI liquidjs harttle | 6.5 | May 9 | LiquidJS is vulnerable to Denial of Service via circular block reference in layout |
| CVE-2026-39859 | LI liquidjs harttle | 7.5 | Apr 8 | LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read |
| CVE-2026-39412 | LI liquidjs harttle | 7.5 | Apr 8 | LiquidJS has an ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting side-channel |
| CVE-2026-35525 | LI liquidjs harttle | 7.5 | Apr 8 | LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates |
| CVE-2026-34166 | LI liquidjs harttle | 5.3 | Apr 8 | LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter |
| CVE-2026-33285 | LI liquidjs harttle | 7.5 | Mar 26 | LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash |
| CVE-2026-33287 | LI liquidjs harttle | 7.5 | Mar 26 | LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern |
| CVE-2026-30952 | LI liquidjs harttle | 7.5 | Mar 10 | liquidjs has a path traversal fallback vulnerability |